CVE-2018-17572: 
InfluxDB vulnerability analysis and mitigation

InfluxDB version 0.9.5 was discovered to contain a Reflected Cross-Site Scripting (XSS) vulnerability in its Write Data module. The vulnerability was assigned CVE-2018-17572 and was disclosed on September 27, 2018. This security issue affects InfluxDB installations running version 0.9.5 and earlier versions (MITRE CVE, NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue, specifically involving improper neutralization of input during web page generation. According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The CVSS v2.0 Base Score is 3.5 (LOW) with the vector (AV:N/AC:M/Au:S/C:N/I:P/A:N) (NVD).

The vulnerability allows attackers to inject malicious JavaScript code into the Write Data Module of InfluxDB. When successfully exploited, this could lead to the execution of arbitrary JavaScript code in the context of other users' browsers who access the affected pages (GitHub POC).

The vulnerability can be exploited through the admin panel, where it is possible to inject malicious JavaScript into the Write Data Module. A proof of concept demonstrates that an attacker can execute arbitrary JavaScript code using simple alert commands (GitHub POC).

The vulnerability was addressed in InfluxDB version 0.9.6. Users are advised to upgrade to this version or later to mitigate the risk (InfluxDB Release).